App Engine查询Secret Manager出现grpc DEADLINE_EXCEEDED超时如何解决？

在App Engine中查询Secret Manager时抛出io.grpc.StatusRuntimeException: DEADLINE_EXCEEDED异常，具体场景为：尝试在App Engine应用中调用listSecrets()接口列出Secret Manager中的密钥时，gRPC请求总会在60秒后超时，报错栈如下：

com.google.api.gax.rpc.DeadlineExceededException: io.grpc.StatusRuntimeException: DEADLINE_EXCEEDED: Deadline exceeded after 59.973305176s.
        at com.google.api.gax.rpc.ApiExceptionFactory.createException(ApiExceptionFactory.java:51)
        at com.google.api.gax.grpc.GrpcApiExceptionFactory.create(GrpcApiExceptionFactory.java:72)
        at com.google.api.gax.grpc.GrpcApiExceptionFactory.create(GrpcApiExceptionFactory.java:60)
        at com.google.api.gax.grpc.GrpcExceptionCallable$ExceptionTransformingFuture.onFailure(GrpcExceptionCallable.java:97)
        at com.google.api.core.ApiFutures$1.onFailure(ApiFutures.java:68)
        at com.google.common.util.concurrent.Futures$CallbackListener.run(Futures.java:1074)
        at com.google.common.util.concurrent.DirectExecutor.execute(DirectExecutor.java:30)
        at com.google.common.util.concurrent.AbstractFuture.executeListener(AbstractFuture.java:1213)
        at com.google.common.util.concurrent.AbstractFuture.complete(AbstractFuture.java:983)
        at com.google.common.util.concurrent.AbstractFuture.setException(AbstractFuture.java:771)
        at io.grpc.stub.ClientCalls$GrpcFuture.setException(ClientCalls.java:563)
        at io.grpc.stub.ClientCalls$UnaryStreamToFuture.onClose(ClientCalls.java:533)
        at io.grpc.internal.DelayedClientCall$CloseListenerRunnable.runInContext(DelayedClientCall.java:406)
        at io.grpc.internal.ContextRunnable.run(ContextRunnable.java:37)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)
        Suppressed: com.google.api.gax.rpc.AsyncTaskException: Asynchronous task failed

已验证前提 #

• 该App Engine可正常访问其他GCP服务
• App Engine默认服务账号已配置Secret Manager对应操作权限
• 应用为App Engine标准环境第二代Java 11 runtime，依赖管理使用最新v23.0.0版本libraries-bom
• 相同代码在本地运行正常，请求耗时仅数秒，排除代码逻辑问题

解决方案 #

改用非gRPC的HTTP版本Secret Manager客户端即可解决该问题，需要引入google-api-services-secretmanager、google-api-client、google-auth-library-oauth2-http依赖，可正常运行的代码片段如下：

var projectId = "<TODO>";
var credentials = GoogleCredentials.getApplicationDefault();
var secretManager = new SecretManager.Builder(
        new NetHttpTransport(),
        new GsonFactory(),
        new HttpCredentialsAdapter(credentials))
        .build();

ArrayList<Secret> secrets = new ArrayList<>();
String pageToken = null;
do {
    var response = secretManager.projects().secrets().list("projects/" + projectId)
            .setPageToken(pageToken)
            .execute();
    pageToken = response.getNextPageToken();
    secrets.addAll(response.getSecrets());
} while (pageToken != null);

以上代码在本地和App Engine环境中均可正常运行。

内容的提问来源于stack exchange，提问作者David Ehrmann